1 #ifndef _SELINUX_H_ 2 #define _SELINUX_H_ 3 4 #include <sys/types.h> 5 #include <stdarg.h> 6 7 #ifdef __cplusplus 8 extern "C" { 9 #endif 10 11 /* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */ 12 extern int is_selinux_enabled(void); 13 /* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */ 14 extern int is_selinux_mls_enabled(void); 15 16 /* No longer used; here for compatibility with legacy callers. */ 17 typedef char *security_context_t; 18 19 /* Free the memory allocated for a context by any of the below get* calls. */ 20 extern void freecon(char * con); 21 22 /* Free the memory allocated for a context array by security_compute_user. */ 23 extern void freeconary(char ** con); 24 25 /* Wrappers for the /proc/pid/attr API. */ 26 27 /* Get current context, and set *con to refer to it. 28 Caller must free via freecon. */ 29 extern int getcon(char ** con); 30 31 /* Set the current security context to con. 32 Note that use of this function requires that the entire application 33 be trusted to maintain any desired separation between the old and new 34 security contexts, unlike exec-based transitions performed via setexeccon. 35 When possible, decompose your application and use setexeccon()+execve() 36 instead. Note that the application may lose access to its open descriptors 37 as a result of a setcon() unless policy allows it to use descriptors opened 38 by the old context. */ 39 extern int setcon(const char * con); 40 41 /* Get context of process identified by pid, and 42 set *con to refer to it. Caller must free via freecon. */ 43 extern int getpidcon(pid_t pid, char ** con); 44 45 /* Get previous context (prior to last exec), and set *con to refer to it. 46 Caller must free via freecon. */ 47 extern int getprevcon(char ** con); 48 49 /* Get exec context, and set *con to refer to it. 50 Sets *con to NULL if no exec context has been set, i.e. using default. 51 If non-NULL, caller must free via freecon. */ 52 extern int getexeccon(char ** con); 53 54 /* Set exec security context for the next execve. 55 Call with NULL if you want to reset to the default. */ 56 extern int setexeccon(const char * con); 57 58 /* Get fscreate context, and set *con to refer to it. 59 Sets *con to NULL if no fs create context has been set, i.e. using default. 60 If non-NULL, caller must free via freecon. */ 61 extern int getfscreatecon(char ** con); 62 63 /* Set the fscreate security context for subsequent file creations. 64 Call with NULL if you want to reset to the default. */ 65 extern int setfscreatecon(const char * context); 66 67 /* Get keycreate context, and set *con to refer to it. 68 Sets *con to NULL if no key create context has been set, i.e. using default. 69 If non-NULL, caller must free via freecon. */ 70 extern int getkeycreatecon(char ** con); 71 72 /* Set the keycreate security context for subsequent key creations. 73 Call with NULL if you want to reset to the default. */ 74 extern int setkeycreatecon(const char * context); 75 76 /* Get sockcreate context, and set *con to refer to it. 77 Sets *con to NULL if no socket create context has been set, i.e. using default. 78 If non-NULL, caller must free via freecon. */ 79 extern int getsockcreatecon(char ** con); 80 81 /* Set the sockcreate security context for subsequent socket creations. 82 Call with NULL if you want to reset to the default. */ 83 extern int setsockcreatecon(const char * context); 84 85 /* Wrappers for the xattr API. */ 86 87 /* Get file context, and set *con to refer to it. 88 Caller must free via freecon. */ 89 extern int getfilecon(const char *path, char ** con); 90 extern int lgetfilecon(const char *path, char ** con); 91 extern int fgetfilecon(int fd, char ** con); 92 93 /* Set file context */ 94 extern int setfilecon(const char *path, const char *con); 95 extern int lsetfilecon(const char *path, const char *con); 96 extern int fsetfilecon(int fd, const char *con); 97 98 /* Wrappers for the socket API */ 99 100 /* Get context of peer socket, and set *con to refer to it. 101 Caller must free via freecon. */ 102 extern int getpeercon(int fd, char ** con); 103 104 /* Wrappers for the selinuxfs (policy) API. */ 105 106 typedef unsigned int access_vector_t; 107 typedef unsigned short security_class_t; 108 109 struct av_decision { 110 access_vector_t allowed; 111 access_vector_t decided; 112 access_vector_t auditallow; 113 access_vector_t auditdeny; 114 unsigned int seqno; 115 unsigned int flags; 116 }; 117 118 /* Definitions of av_decision.flags */ 119 #define SELINUX_AVD_FLAGS_PERMISSIVE 0x0001 120 121 /* Structure for passing options, used by AVC and label subsystems */ 122 struct selinux_opt { 123 int type; 124 const char *value; 125 }; 126 127 /* Callback facilities */ 128 union selinux_callback { 129 /* log the printf-style format and arguments, 130 with the type code indicating the type of message */ 131 int 132 #ifdef __GNUC__ 133 __attribute__ ((format(printf, 2, 3))) 134 #endif 135 (*func_log) (int type, const char *fmt, ...); 136 /* store a string representation of auditdata (corresponding 137 to the given security class) into msgbuf. */ 138 int (*func_audit) (void *auditdata, security_class_t cls, 139 char *msgbuf, size_t msgbufsize); 140 /* validate the supplied context, modifying if necessary */ 141 int (*func_validate) (char **ctx); 142 /* netlink callback for setenforce message */ 143 int (*func_setenforce) (int enforcing); 144 /* netlink callback for policyload message */ 145 int (*func_policyload) (int seqno); 146 }; 147 148 #define SELINUX_CB_LOG 0 149 #define SELINUX_CB_AUDIT 1 150 #define SELINUX_CB_VALIDATE 2 151 #define SELINUX_CB_SETENFORCE 3 152 #define SELINUX_CB_POLICYLOAD 4 153 154 extern union selinux_callback selinux_get_callback(int type); 155 extern void selinux_set_callback(int type, union selinux_callback cb); 156 157 /* Logging type codes, passed to the logging callback */ 158 #define SELINUX_ERROR 0 159 #define SELINUX_WARNING 1 160 #define SELINUX_INFO 2 161 #define SELINUX_AVC 3 162 163 /* Compute an access decision. */ 164 extern int security_compute_av(const char * scon, 165 const char * tcon, 166 security_class_t tclass, 167 access_vector_t requested, 168 struct av_decision *avd); 169 170 /* Compute a labeling decision and set *newcon to refer to it. 171 Caller must free via freecon. */ 172 extern int security_compute_create(const char * scon, 173 const char * tcon, 174 security_class_t tclass, 175 char ** newcon); 176 177 /* Compute a relabeling decision and set *newcon to refer to it. 178 Caller must free via freecon. */ 179 extern int security_compute_relabel(const char * scon, 180 const char * tcon, 181 security_class_t tclass, 182 char ** newcon); 183 184 /* Compute a polyinstantiation member decision and set *newcon to refer to it. 185 Caller must free via freecon. */ 186 extern int security_compute_member(const char * scon, 187 const char * tcon, 188 security_class_t tclass, 189 char ** newcon); 190 191 /* Compute the set of reachable user contexts and set *con to refer to 192 the NULL-terminated array of contexts. Caller must free via freeconary. */ 193 extern int security_compute_user(const char * scon, 194 const char *username, 195 char *** con); 196 197 /* Load a policy configuration. */ 198 extern int security_load_policy(void *data, size_t len); 199 200 /* Get the context of an initial kernel security identifier by name. 201 Caller must free via freecon */ 202 extern int security_get_initial_context(const char *name, 203 char ** con); 204 205 /* Translate boolean strict to name value pair. */ 206 typedef struct { 207 const char *name; 208 int value; 209 } SELboolean; 210 /* save a list of booleans in a single transaction. */ 211 extern int security_set_boolean_list(size_t boolcnt, 212 SELboolean * const boollist, int permanent); 213 214 /* Check the validity of a security context. */ 215 extern int security_check_context(const char * con); 216 217 /* Canonicalize a security context. */ 218 extern int security_canonicalize_context(const char * con, 219 char ** canoncon); 220 221 /* Get the enforce flag value. */ 222 extern int security_getenforce(void); 223 224 /* Set the enforce flag value. */ 225 extern int security_setenforce(int value); 226 227 /* Get the behavior for undefined classes/permissions */ 228 extern int security_deny_unknown(void); 229 230 /* Disable SELinux at runtime (must be done prior to initial policy load). */ 231 extern int security_disable(void); 232 233 /* Get the policy version number. */ 234 extern int security_policyvers(void); 235 236 /* Get the boolean names */ 237 extern int security_get_boolean_names(char ***names, int *len); 238 239 /* Get the pending value for the boolean */ 240 extern int security_get_boolean_pending(const char *name); 241 242 /* Get the active value for the boolean */ 243 extern int security_get_boolean_active(const char *name); 244 245 /* Set the pending value for the boolean */ 246 extern int security_set_boolean(const char *name, int value); 247 248 /* Commit the pending values for the booleans */ 249 extern int security_commit_booleans(void); 250 251 /* Userspace class mapping support */ 252 struct security_class_mapping { 253 const char *name; 254 const char *perms[sizeof(access_vector_t) * 8 + 1]; 255 }; 256 257 extern int selinux_set_mapping(struct security_class_mapping *map); 258 259 /* Common helpers */ 260 261 /* Convert between security class values and string names */ 262 extern security_class_t string_to_security_class(const char *name); 263 extern const char *security_class_to_string(security_class_t cls); 264 265 /* Convert between individual access vector permissions and string names */ 266 extern const char *security_av_perm_to_string(security_class_t tclass, 267 access_vector_t perm); 268 extern access_vector_t string_to_av_perm(security_class_t tclass, 269 const char *name); 270 271 /* Returns an access vector in a string representation. User must free the 272 * returned string via free(). */ 273 extern int security_av_string(security_class_t tclass, 274 access_vector_t av, char **result); 275 276 /* Check permissions and perform appropriate auditing. */ 277 extern int selinux_check_access(const char * scon, 278 const char * tcon, 279 const char *tclass, 280 const char *perm, void *aux); 281 282 /* Set the path to the selinuxfs mount point explicitly. 283 Normally, this is determined automatically during libselinux 284 initialization, but this is not always possible, e.g. for /sbin/init 285 which performs the initial mount of selinuxfs. */ 286 void set_selinuxmnt(const char *mnt); 287 288 #ifdef __cplusplus 289 } 290 #endif 291 #endif 292
